[Cryptography] Passwords: Perfect, except for being Flawed

[Rob Meijer]

2015-02-19 17:18 GMT+01:00 ianG <iang at iang.org>:

> On 18/02/2015 17:21 pm, Kent Borg wrote:
>
>  The human is part of the security system.
>>
>
> Odd thing to say ;)  Security means nothing outside the context of a human.
>
>
>
> As a meta-comment on passwords:  there is a big shift underway now to
> start doing dual factor using the person's phone.  It is now clear that
> everyone has a phone, to some statistical certainty, and we can rely on
> it.  So every system and his dog has now migrated to using something to
> couple the phone and the password together.
>
> (In the meantime, while this Phone+password hybrid rolls out, others have
> gone further.  ApplePay, bitcoin light clients, my stuff, are putting the
> whole thing on the phone.  So, actually we are exposing the phone to single
> points of failure/attack modes.  But this direction is still so novel and
> so far rare that there is no economic case for attack and won't be for a
> few years...)
>
> Which is to say, micro-re-designs of how passwords work and can be
> improved might be missing a macro-trend that is going on.


​Interesting. An other possible way to look at mobile phones could be as a
large keyring with (pseudo) anonymous​ keys. So rather than using the phone
as single token for proving identity, it could be a granular tool for
proving our 'specific' authority. If all the authority can be revoked all
at once by a caretaker we control from our home, we could simple revoke all
of our phone's authority if ever we lost it or it got stolen.

Passwords are both (poor) tokens of authority and (poor) tokens for proving
identity. Two factor authentication makes for better tokens for proving
identity, but kills the (useful)  tokens of authority property that allows
us to share a password in order to delegate authority. If we can manage to
minimize the need for  tokens for proving identity and use tokens for
proving authority (capabilities) instead, than mobile phones could be an
interesting carriage for such tokens if we manage to get access control on
these devices sufficiently locked down to allow individual apps to keep
these authority tokens secret from each-other.

A mobile phone as secure capability wallet. Would be an interesting project
to work on ;-)




>
>
> iang
>
>
> _______________________________________________
> The cryptography mailing list
> cryptography at metzdowd.com
> http://www.metzdowd.com/mailman/listinfo/cryptography
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20150223/1acac14c/attachment.html>